Rank Math PRO 3.0.123 trojanized in supply chain attack: self-restoring WordPress backdoor (CVE-2026-111862)

Linha do tempo

1. gbhackers.com ↗ · pub. 20/10/2026 07:48 · coletado 20/10 09:00

   Rank Math PRO 3.0.123 Plugin Compromised to Deliver Persistent Backdoor and Enable Credential Theft on WordPress Sites

   ler a análise desta fonte ocultar

   Rank Math reported a security incident in which its premium Rank Math PRO WordPress plugin, version 3.0.123, was distributed with malware. Sites are at risk if administrators activated the compromised version. The affected download window ran from October 15, 2023 20:02 UTC to October 16, 2023 07:12 UTC (dates as stated in the article), and a limited number of users are affected. The free Rank Math SEO plugin on WordPress.org is not affected. Rank Math removed the malicious files and released clean version 3.0.124. The advisory does not name the attacker, explain how the distribution files were compromised, or quantify affected installations.

   Technical Details

   • The malware recreates a hidden backdoor whenever someone visits an infected site, so disabling the plugin or deleting individual files does not remove the compromise.
   • Malicious entries exist in the WordPress options table under option_name values _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
   • Suspicious PHP files may be found in must-use plugins, other plugin directories, non-default theme folders and Rank Math's includes directory. Code indicators include base64_decode combined with XOR loops, the key xmmqhn, proc_open and PHP-FPM socket code.
   • Other artifacts: unauthorized administrator accounts starting with wpsupport_, email addresses ending in @wp-mail[.]net, the fake core file wp-includes/class-wp-cache-util.php, .htaccess rules enabling PHP execution in .cache files, and system cron entries tagged #ms6v46.
   • Outbound communication to rank1cdn[.]com is flagged for blocking.
   • Rank Math advises assuming that sensitive information accessible to the compromised site may have been exposed, although credential theft is not confirmed for every installation.

   Remediation

   • Preferred: restore files and database from a clean backup made before October 15, 2023 20:02 UTC, then scan, rotate credentials and install version 3.0.124.
   • Without a clean backup: delete the entire rank-math-pro directory, remove the malicious options entries and the other persistence mechanisms, then investigate further changes.
   • Block outbound connections to rank1cdn[.]com where possible.
   • Rotate WordPress passwords, database credentials, security keys and salts, API tokens, payment gateway keys, SMTP credentials, hosting, FTP/SFTP and SSH credentials, and secrets in environment variables. Review and reset two-factor authentication settings if needed.
   • After cleanup, run wp core verify-checksums and wp plugin verify-checksums --all, scan with reputable tools, and monitor outbound traffic and deleted files for recurrence. Premium plugins may lack public checksums, so compare against clean official packages.
   • Users who installed but did not activate 3.0.123 should delete it, install the clean release and scan.
2. bleepingcomputer.com ↗ · pub. 19/10/2026 18:24 · coletado 19/10 19:00

   Rank Math PRO 3.0.123 trojanized in supply-chain attack, planting hidden backdoors on WordPress sites

   ler a análise desta fonte ocultar

   A supply-chain attack compromised Rank Math PRO (WordPress SEO plugin) version 3.0.123, downloaded from the vendor's official website between October 15 20:02 UTC and October 16 07:12 UTC. The trojanized package planted persistent, self-recreating hidden backdoors on sites where it was activated, and exposed database credentials, API keys and other secrets accessible to the web server. The free Rank Math SEO from WordPress.org was not affected. The vendor released clean version 3.0.124 and has not disclosed the number of affected sites or the initial attack vector. BleepingComputer also found a related PHP sample on VirusTotal, but could not confirm it was distributed via the compromised plugin.

   Technical Details

   • The malware communicates with rank1cdn[.]com, establishes persistence and recreates hidden backdoors when the infected site is visited.
   • Backdoor file referenced by the vendor: wp-includes/class-wp-cache-util.php.
   • IoCs: XOR obfuscation key xmmqhn, database entry _np5pvf754c, cron job marker #ms6v46, and creation of administrator accounts with the wpsupport_ username prefix and @wp-mail.net email addresses.
   • VirusTotal sample cache-preloader-fff033 (1).php shares these IoCs and appears to be a first-stage deployment script. It can execute commands, modify WordPress databases, and steal AWS, Cloudflare, Google Cloud and Azure credentials, SSH keys and other sensitive data. Its link to the compromised plugin is unconfirmed.

   Remediation

   • Treat any site that installed and activated 3.0.123 as compromised.
   • Restore files and database from a clean backup, run security scans, and rotate all passwords, keys and salts.
   • Without a clean backup, clean up manually: delete the entire plugin folder and malicious database entries, then hunt for additional backdoors, unauthorized administrator accounts, altered files, scheduled tasks and changes outside WordPress. Deactivating or updating the plugin does not remove the threat.
   • Block outbound connections to rank1cdn[.]com.
   • If the plugin was installed but never activated, delete it, download clean 3.0.124 and scan the site.
3. securityweek.com ↗ · pub. 19/10/2026 12:20 · coletado 19/10 17:53

   Rank Math PRO WordPress plugin v3.0.123 trojanized in supply chain attack, installing persistent backdoor

   ler a análise desta fonte ocultar

   The Rank Math PRO WordPress SEO plugin was hit by a supply chain attack. Some packages of version 3.0.123 contained malware that could let attackers take over websites once the plugin was activated. Users who downloaded or updated the plugin between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC may be infected. Rank Math removed the affected files and released clean version 3.0.124. Sites that installed and activated 3.0.123 in that window should be treated as compromised.

   Technical Details

   • The malware may recreate a hidden backdoor on every page visit, which makes manual cleanup difficult.
   • It may deploy fake WordPress core files and modify .htaccess so that .cache files execute as PHP.
   • It may drop .cache files containing PHP code, schedule tasks and cron jobs, modify other plugins and themes, and upload further files.
   • It may expose credentials, API keys and other secrets.
   • The attackers could also make changes outside the WordPress installation, such as SSH authorized_keys files, crontabs of other system users, and suspicious processes.
   • The attacker domain is rank1cdn[.]com.

   Remediation

   • Restore the site from a clean backup created before the incident.
   • If no backup is available, delete the Rank Math PRO plugin folder and remove the malicious database entry.
   • Block rank1cdn[.]com.
   • Remove suspicious PHP files and unknown administrator accounts.
   • Check SSH authorized_keys, crontabs, running processes and other locations the web server user can write to.
   • After verifying the site is clean, change all passwords and install a clean version of Rank Math PRO (3.0.124 or later).
4. thehackernews.com ↗ · pub. 19/10/2026 13:28 · coletado 19/10 17:53 primeiro registro

   Rank Math PRO update channel compromised to deliver self-restoring backdoor in version 3.0.123 (CVE-2026-111862)

   ler a análise desta fonte ocultar

   Rank Math disclosed that copies of Rank Math PRO, the paid WordPress SEO plugin, downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026 contained malware. Any site that installed and activated an affected copy should be treated as compromised. The malware can recreate its hidden backdoor whenever someone visits the site. Wordfence assigned the incident CVE-2026-111862 (CVSS 9.8) and Patchstack classifies it as a backdoor. Because the compromise occurred on the vendor's own systems, Patchstack says no mitigation rule is possible. No code analysis and no attribution have been published. The free plugin on WordPress.org is not named in the notice.

   Technical Details

   • The version number does not show whether a copy is affected. Version 3.0.123 was dated October 7, and only copies downloaded or installed during the window are in scope. Rank Math has not said how the malicious files entered its download and update system, how many customers received them, or whether automatic updates delivered them.
   • The domain rank1cdn[.]com, which owners are told to block, was registered at 19:31 UTC on October 14, about a day before the window opened.
   • Persistence and artifacts listed in the advisories:
     • PHP backdoor files in other plugins' folders, theme inc/, includes/ and lib/ folders, wp-content/mu-plugins/, Rank Math's includes/ folder and uploads/.
     • A fake core file, wp-includes/class-wp-cache-util.php.
     • New administrator accounts named wpsupport_* or with @wp-mail[.]net addresses.
     • .htaccess changes that run .cache files as PHP.
     • Crontab entries tagged #ms6v46, WordPress scheduled events and SSH authorized_keys entries.
     • wp_options entries _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
   • Code indicators are PHP using base64_decode with XOR loops, the key xmmqhn, proc_open, or PHP-FPM socket code.
   • Any password, database credential, API key or other secret the site could reach should be assumed exposed.
   • Context: this is at least the third premium WordPress plugin vendor update channel delivering backdoored builds this year (Nextend Smart Slider 3 Pro in April, ShapedPlugin in June). Awesome Motive's CDN scripts were also altered in June and BdThemes' API feed was poisoned in August. No published evidence links these incidents to the same actor.

   Remediation

   • Preferred: restore a site and database backup from before 20:02 UTC on October 15, run a security scan, change all credentials, and only then install clean version 3.0.124 from the Rank Math account.
   • Without a clean backup, before anything else:
     • Delete the entire rank-math-pro folder. Deactivating the plugin is not sufficient.
     • Delete the three malicious wp_options entries.
     • Block outbound connections to rank1cdn[.]com.
   • Then hunt for the artifacts listed above.
   • Installing 3.0.124 does not remove files, accounts or scheduled tasks already planted. Sites that installed and activated 3.0.123 in the window remain compromised even after updating.
   • Rotate all credentials in every case: WordPress passwords, database credentials, wp-config.php keys and salts, payment, SMTP and API keys, hosting panel, FTP/SFTP/SSH access, environment secrets and administrator 2FA.
   • Finish with a security scan and wp core verify-checksums. Plugin checksums may not exist for premium plugins, and none are published for this one.
   • Download 3.0.124 only by logging in at rankmath.com. Rank Math says it will never email login or download links.